Exporting Meeting Call History to CSV/Excel
Is it possible to get a dump of the data from Users\username\call history for a specific meeting and export it to CVS, for example? The data must be there somewhere, but how can I get at this? Via Power Shell maybe? On the page where it shows the breakdown of the meeting detials it displays: Session start time Participant Session type Duration Audio Quality but there is no way to export this on the page it seems.
Teams Meeting Reports With IP Addresses
Hi! I am trying to assist an EDU client of mine with a unique use case. For grant purposes they have a couple courses where they need to be able to pull reporting to reflect the IP addresses of the participants in their meetings. The client is shifting to 100% Teams, eliminating some of the shadow activities with Zoom. Zoom can currently meet this use case for them, so we are trying to help them identify comparable options in Teams to support the full transition. Is anyone aware of any reporting options either in the meeting or via admin portal that can include the IP information for the participants in addition to the standard meeting attendance reports?
Sentinel Reports
We are switching over from an on-prem SIEM solution and moving to Sentinel. One very nice feature of our previous SIEM was that we could generate PDF reports for the board meetings very easily. I know you can make wondering graphs and dashboards within Sentinel using Playbooks and such but is the only way I have found to get them out of Sentinel is in an excel spreadsheet. Has anyone found a way to nicely generate reports through Sentinel?Defender365 Alerts for high volume file deletion
All of a sudden we're getting large volumes of alerts from Defender for unusual volume of file deletions. We seldom get these and when we do it has previously turned out to be a user clearing old files etc. But these alerts now are mostly for the app-data folder and and now today some from C:/temp. The thing that has me questioning is the items deleted and the apps involved. For example, most deleted items seem to be from the appdata folder, but for Microsoft.Windows.Search_cw5n1h2txyewy and some of the files are named things like Photo, but they are json files. Second thing that has me questioning is the applications involved, which a few are from taskhostw.exe which im worried is being used to setup some sort of persistent access. Has anyone else been experiencing these unusual volume of alerts? Wondering if its due to some sort of windows update or a bug in defender.
Reporting on Known Folder Move status?
I've had it on my list for a while to deploy OneDrive to users in our org, replacing their existing home drives in the process. I think it might also allow us to finally eliminate roaming profiles as well. Known Folder Move seems like it will make this much easier compared to the old method using Folder Redirection. However, I need to know for sure that KFM is active for users before I tell them it's safe to save in 'Documents' and then turn off their roaming profile. Is there any option to report on which users have KFM enabled, and for which folders?
